3 ms·

> I'm so worried about sharing my passwords with ANY third party. Eventually they all get owned... 1) Many password managers are designed specifically to survi

by ZoFreX 10y ago

> I'm so worried about sharing my passwords with ANY third party. Eventually they all get owned... 1) Many password managers are designed specifically to survive the website being owned. I use LastPass and I'm not sharing my passwords with them, I'm sharing my encrypted passwords with them. It's an important consideration! 2) You don't want to trust a third party so you use a Chrome extension that is made by a third party and has permission to access any website? You are trusting a third party.

stratosgear 10y ago
Well, I know exactly what goes in the Chrome extension (https://github.com/ericwoodruff/passwordhasherplus https://github.com/ericwoodruff/passwordhasherplus) or the android app (https://github.com/ginkel/hashit https://github.com/ginkel/hashit) The point is that I do NOT want to store (even hashed) passwords with a third party in the hopes that they will be able to protect my passwords, when I can generate them on the spot from the device I'm using. But that's just me. My post was just a comment on how people find third party password managers so secure. I can't be the only paranoid about this...
- ZoFreX 10y ago
  Obviously there's a trade-off between security and convenience here, and that's a very personal choice to everyone, so I'm not going to argue that part of things with you. I do have to point out a couple of things though. Password managers don't store "hashed" passwords with a third party - they store encrypted ones. I also wouldn't personally use the phrase "in the hopes that they will be able to protect my passwords" - I don't rely on LastPass protecting squat. If their entire database leaked, my passwords are still safe. I think that element of the design is very important and wouldn't use a system where hope was required! You certainly aren't the only paranoid one and lots of people on HN seem pretty wary of password managers :)
chiefalchemist 10y ago
Another option is to store your full PW and/or user name. For example, add a +++ to every pw but don't store that bit in the PWM. If nothing else, it makes things that much less obvious
- ZoFreX 10y ago
  My key criteria for any password method is "what if everyone uses it?". If a major PWM fails, and lots of people did something like this, you can bet your boots that password crackers would give it a go and retrieve your real password.

by ZoFreX 10y ago

stratosgear 10y ago

Well, I know exactly what goes in the Chrome extension (https://github.com/ericwoodruff/passwordhasherplus https://github.com/ericwoodruff/passwordhasherplus) or the android app (https://github.com/ginkel/hashit https://github.com/ginkel/hashit) The point is that I do NOT want to store (even hashed) passwords with a third party in the hopes that they will be able to protect my passwords, when I can generate them on the spot from the device I'm using. But that's just me. My post was just a comment on how people find third party password managers so secure. I can't be the only paranoid about this...

ZoFreX 10y ago
Obviously there's a trade-off between security and convenience here, and that's a very personal choice to everyone, so I'm not going to argue that part of things with you. I do have to point out a couple of things though. Password managers don't store "hashed" passwords with a third party - they store encrypted ones. I also wouldn't personally use the phrase "in the hopes that they will be able to protect my passwords" - I don't rely on LastPass protecting squat. If their entire database leaked, my passwords are still safe. I think that element of the design is very important and wouldn't use a system where hope was required! You certainly aren't the only paranoid one and lots of people on HN seem pretty wary of password managers :)

chiefalchemist 10y ago

Another option is to store your full PW and/or user name. For example, add a +++ to every pw but don't store that bit in the PWM. If nothing else, it makes things that much less obvious

ZoFreX 10y ago
My key criteria for any password method is "what if everyone uses it?". If a major PWM fails, and lots of people did something like this, you can bet your boots that password crackers would give it a go and retrieve your real password.